Anomaly detection method, anomaly detection apparatus, and computer program product

Abstract

The artificial intelligence model is used to automatically detect abnormalities in various to-be-detected data, thereby realizing timely abnormality detection, reducing the need for technicians to visit the site, and improving the efficiency and accuracy of abnormality detection.SOLUTION: Performing noise removal processing on noise data by using a noise removal model to generate noise-removed data, performing correction processing on the noise-removed data according to data to be detected, so that the corrected data is closer to the data to be detected than the noise-removed data, inputting the corrected data into the noise removal model, and repeating the noise removal processing and the correction processing for a plurality of times to obtain final corrected data, and detecting whether there is an abnormality in the data to be detected according to the final corrected data and the data to be detected.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to the field of artificial intelligence detection, and in particular to an anomaly detection method, an anomaly detection apparatus, and a computer program product. [Background technology]

[0002] With the rapid development of the Internet and communication technology, the amount of information is increasing exponentially, and the complexity of communication networks and base stations is also increasing. As a result, the number of metrics that need to be monitored is also rapidly increasing, and the scale of these metrics is also enormous. If potential errors cannot be quickly identified and addressed, it may lead to serious risks, such as service interruptions. Therefore, the implementation of a timely anomaly detection mechanism is essential to ensure the stability and reliability of the system.

[0003] Conventional anomaly monitoring methods involve periodic manual inspections. However, with the rapid development of communication technology, the volume of information and the complexity of networks have increased, making fault detection more frequent and repairing them more difficult. Therefore, conventional manual inspection methods have problems such as high cost, slow response speed, low security, unverifiable results, and incomplete information. Therefore, to detect faults early and take corrective action promptly, automated measures are being actively developed to monitor the operation of wireless communication networks. Summary of the Invention [Problem to be solved by the invention]

[0004] While there are currently several automated anomaly detection methods, their practical application is limited. A key challenge is that these solutions underutilize much of the existing data information, resulting in low accuracy of detection results. Therefore, there is a need to develop more intelligent and efficient solutions to improve the accuracy and reliability of anomaly detection and better meet the needs of modern communication networks and information systems.

[0005] In view of the above problems, the present disclosure provides an anomaly detection method, an anomaly detection device, and a computer program product. [Means for solving the problem]

[0006] According to one aspect of the present disclosure, there is provided an anomaly detection method including the steps of: performing a noise removal process on noise data using a noise removal model to generate noise-removed data; performing a correction process on the noise-removed data based on detection target data to make the corrected data closer to the detection target data than the noise-removed data; inputting the corrected data into the noise removal model and repeating the noise removal process and the correction process multiple times to obtain final corrected data; and detecting whether or not there is an anomaly in the detection target data based on the final corrected data and the detection target data.

[0007] According to one embodiment of the present disclosure, the noise removal process is performed by selecting corresponding model parameters of the noise removal model based on the number of times the noise removal process has been repeated.

[0008] According to one embodiment of the present disclosure, the noise distribution that the noise data follows is the same as the noise distribution that training data used to train the noise removal model follows, and the noise data has a size similar to that of the detection target data.

[0009] According to one embodiment of the present disclosure, the correction process is based on all points in the detection target data.

[0010] According to one embodiment of the present disclosure, the correction process is based on a gradient correction method to make the corrected data closer to the detection target data than the noise-removed data.

[0011] According to one embodiment of the present disclosure, the step of performing the correction processing based on the gradient correction method includes a step of obtaining a difference by subtracting the noise-removed data from the detection target data, and a step of multiplying the difference by a weight and then adding the noise-removed data to obtain the corrected data.

[0012] According to one embodiment of the present disclosure, the step of detecting whether or not there is an abnormality in the detection target data includes a step of determining that there is an abnormality in the detection target data if the difference between a point in the final corrected data and a corresponding point in the detection target data is greater than a threshold value.

[0013] According to one embodiment of the present disclosure, the detection target data is time-series data of indicators of a communication system.

[0014] According to another aspect of the present disclosure, there is provided an anomaly detection device, the anomaly detection device including: a noise removal unit that performs noise removal processing on noise data using a noise removal model to generate noise-removed data; and a correction unit that performs correction processing on the noise-removed data based on detection target data to make the corrected data closer to the detection target data than the noise-removed data, wherein the noise removal unit and the correction unit repeat the noise removal processing and the correction processing on the corrected data multiple times to obtain final corrected data, and the anomaly detection device further includes a detection unit that detects whether or not the detection target data has an abnormality based on the final corrected data and the detection target data.

[0015] According to another aspect of the present disclosure, there is provided a computer program product comprising computer commands, which when executed by a processor, perform the anomaly detection method according to any one of claims 1 to 9. [Effects of the Invention]

[0016] According to the anomaly detection method disclosed herein, an artificial intelligence model is used to automatically detect anomalies in various detection target data, thereby achieving timely anomaly detection, reducing the need for on-site visits by engineers, and improving the efficiency and accuracy of anomaly detection. Furthermore, by using all points in the detection target data to correct data from which noise has been removed using the artificial intelligence model, known information can be fully utilized and the accuracy of anomaly detection can be improved. Furthermore, by applying the anomaly detection method described herein to a communication network, network anomalies can be detected in a timely manner and corresponding processing can be performed, thereby improving the reliability of the communication network. [Brief explanation of the drawings]

[0017] The above-mentioned and other objects, features, and advantages of the present disclosure will become more apparent from the detailed description of the embodiments of the present disclosure in combination with the drawings. The drawings are used to further understand the embodiments of the present disclosure and are constituted as a part of this specification. The drawings, together with the embodiments of the present disclosure, are used to explain the present disclosure and are not intended to limit the present disclosure. In the drawings, the same drawing numbers generally represent the same parts or steps.

[0018] [Figure 1] FIG. 1 is a schematic diagram showing the output data of an interpolation-based anomaly detection method. [Figure 2] FIG. 2 is a flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a schematic diagram illustrating an anomaly detection method according to an embodiment of the present disclosure. [Figure 4]FIG. 4 is a graph illustrating the performance of an interpolation-based anomaly detection method according to an embodiment of the present disclosure. [Figure 5] FIG. 5 is a schematic diagram illustrating an anomaly detection device according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a schematic diagram illustrating a computer-readable storage medium according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present disclosure in combination with the drawings in the embodiments of the present invention. Of course, the described embodiments are only a part of the embodiments of the present disclosure, and are not all of the embodiments. Any other embodiments obtained based on the embodiments of the present disclosure without the need for creative efforts by those skilled in the art should fall within the scope of protection of the present disclosure.

[0020] This disclosure uses flowcharts to describe steps of methods according to embodiments of the present application. It should be understood that previous or subsequent steps do not necessarily occur in order. Conversely, various steps may be performed in reverse order or simultaneously. Additionally, other operations may be added to these processes, or one or more steps of these processes may be omitted.

[0021] FIG. 1 is a schematic diagram showing the output data of an interpolation-based anomaly detection method.

[0022] In an interpolation-based anomaly detection method, several observation points are selected from the detection target data, and the noise data is input to a noise removal model. The noise removal model uses the observation points as a hard condition for the output data. There are no restrictions on points other than the observation points. The noise removal model outputs noise-removed data, and the final output data is obtained after multiple rounds of noise removal by the noise removal model. However, due to the small number of selected observation points, the output is restricted only by the observation points and may be output in multiple forms, such as the first and second outputs in Figure 1. While the first output is the desired normal data, comparing the first output with the detection target data reveals that the detection target data is significantly different from the first output overall, indicating that the detection target data contains an anomaly. Furthermore, while the detection target data contains an anomaly in the middle portion, the first and second portions contain no anomalies, indicating that this is correct. Therefore, anomaly detection using the first output is correct. However, the second output is clearly not the desired normal data. Comparing the second output with the detection target data reveals that the detection target data is significantly different from the second output, indicating that the detection target data contains an anomaly. However, further refinement leads to the conclusion that anomalies exist in both the first and second halves of the target data, which is incorrect. This is because the interpolation-based anomaly detection method selected too few observation points, which meant that all known information could not be fully utilized to generate noise-removed data.

[0023] FIG. 2 is a flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure.

[0024] A flowchart of the anomaly detection method 200 according to an embodiment of the present disclosure will be described in detail with reference to Fig. 2. As shown in Fig. 2, the anomaly detection method 200 of the present disclosure includes steps S202 to S208 as follows.

[0025] In step S202, noise removal processing is performed on the noise data using the noise removal model to generate data after noise removal.

[0026] In embodiments of the present disclosure, the denoising model is an artificial intelligence model that removes noise from noisy data to ultimately generate desired normal data. In some embodiments, the denoising model may be a generative model. In some embodiments, the denoising model may be a diffusion model. Although a diffusion model has been described as an example of the denoising model in this specification, those skilled in the art will understand that other applicable generative models may be used as the denoising model.

[0027] In this disclosure, the diffusion model has a forward process and a reverse process, both of which are parameterized Markov chains. In the forward process, random noise with a certain distribution (e.g., a Gaussian distribution) is gradually added to the original data using the Markov chain of the diffusion step. The continuous addition of random noise ultimately results in pure noise data that follows this distribution. For example, if the random noise added to the training data of the noise removal model each time follows an N(0,1) Gaussian distribution, the ultimately generated pure noise data will also follow an N(0,1) Gaussian distribution. Then, the original data, the data with the gradually added noise, and the final pure noise data are used as training data to train the diffusion model and optimize the de-diffusion process. Finally, the trained diffusion model can restore the pure noise data to the original data through the de-diffusion process.

[0028] In one embodiment of the present disclosure, the denoising model can denoise data step by step using the inverse diffusion of the diffusion model to finally generate denoised data. In some examples of the present disclosure, the noise data input to the denoising model follows the same noise distribution as the noise in the training data of the denoising model. In some embodiments, the noise data may follow a Gaussian distribution, such as N(0,1), N(0,2), N(1,2), or other Gaussian distributions.

[0029] In step S204, the data after noise removal is corrected based on the detection target data, so that the corrected data is closer to the detection target data than the data after noise removal.

[0030] In embodiments of the present disclosure, the detection target data is data that needs to be monitored for abnormalities in various application scenarios, including, but not limited to, signal waves (communication signals, voice, etc.), images, text, etc. In some embodiments, the detection target data may be data having a time dimension. In some examples, the detection target data may be a time series. In communication network applications, the detection target data may be a communication indicator that needs to be monitored, such as received signal strength, signal-to-noise ratio, throughput, packet loss rate, etc. In some embodiments of the present disclosure, the noise data input to the noise removal model has the same size as the detection target data, so that the data after noise removal and the detection target data have the expected size.

[0031] In step S206, it is determined whether a preset number of repetitions T (e.g., 100 times) has been reached. If the number of repetitions has not exceeded T ("Yes" in FIG. 2), the process returns to step S202. If not ("No" in FIG. 2), the process proceeds to step S206. The preset number of repetitions T is a positive integer greater than 0.

[0032] In the embodiment of the present disclosure, the correction process may employ a gradient correction method to make the corrected data closer to the target data than the noise-removed data.

[0033] In some embodiments of the present disclosure, performing correction processing using the gradient correction method includes obtaining a difference by subtracting noise-removed data from detection target data, multiplying the difference by a weight, and then adding the noise-removed data to obtain corrected data. In other words, this correction processing can be realized by the following equation (1):

number

[0034] In step S208, whether or not there is an anomaly in the detection target data is detected based on the final corrected data and the detection target data. In some embodiments, the presence or absence of an anomaly may be detected by comparing the final corrected data with the detection target data. For example, in some embodiments, if the difference between a point in the final corrected data and a corresponding point in the detection target data is greater than a threshold, it is determined that there is an anomaly in the detection target data. In some embodiments, if the difference between a point in the final corrected data and a corresponding point in the detection target data is equal to or less than a threshold, it is determined that there is no anomaly in the detection target data.

[0035] In some embodiments, the model parameters of the denoising model change with each iteration. For example, the denoising process is performed by selecting corresponding model parameters of the denoising model based on the number of iterations of the denoising process. This is because, in the training phase, training is performed using data in which noise is gradually added, and it is expected that different denoising effects will be obtained at each denoising step. In such embodiments, the preset number of iterations T is the total number of steps in the despreading process. In some embodiments, the number of iterations is selected based on the number of all points in the detection target data, and the greater the number of all points in the detection target data, the greater the number of iterations.

[0036] In other embodiments, the denoising model may have a single model parameter. That is, the model parameters of the denoising model are constant in the denoising process at each iteration step. That is, in the training phase, only one set of model parameters is trained at different iteration steps. In such embodiments, a non-predetermined number of iterations may be used. For example, the number of iterations may be determined based on the corrected data. For example, if the randomness of the corrected data is reduced to a certain extent (e.g., if the frequency distribution is sufficiently far from a specific probability distribution such as a uniform distribution or a Gaussian distribution), the noise contained in the corrected data is sufficiently low, and such corrected data is considered to be anomaly-free data. In some embodiments, the weight may be selected based on the desired number of iterations. That is, the weight may be set larger as the desired number of iterations decreases, as a width or step length by which the data to be detected is approached in each iteration. However, as described above, the weight should not be set too large. Setting a small weight can prevent the corrected data from approaching the data to be detected too quickly, resulting in potential anomalies.

[0037] In some embodiments, as described above, the detection target data may be time series data. If the detection target data is time series data, those skilled in the art will understand that the noise-removed data, the corrected data, and the final corrected data are also time series data.

[0038] 3 is a schematic diagram illustrating an anomaly detection method according to an embodiment of the present disclosure. The anomaly detection method according to an embodiment of the present disclosure will be described with reference to FIG.

[0039] As shown in Figure 3, the noise data X T is the noise removal model g θ is input to the denoising model g θ (θ is a parameter of the noise removal model) is the received noise data X T Based on the first data X after noise removal T-1Then, based on the detection target data Z, the first data X after noise removal is generated. T-1 is corrected to obtain the corrected first data X' T-1 The first data X after noise removal T-1 and the corrected first data X' is closer to the detection target data Z than T-1 is made slightly closer to the detection target data Z. Next, the corrected first data X' T-1 is the noise removal model g θ is input to the denoising model g θ is the received corrected first data X' T-1 Based on this, the second data X after noise removal T-2 Then, based on the detection target data Z, the second data X after noise removal is generated. T-2 is corrected to obtain the corrected second data X' T-2 The second data X after noise removal T-2 and the corrected second data X' is closer to the detection target data Z than T-2 is made slightly closer to the detection target data Z. In this way, the noise removal process and correction process are repeated T times (T is a positive integer greater than 0 and indicates the number of repetitions) to obtain final corrected data X'0, and by comparing this final corrected data X'0 with the detection target data Z, it is possible to detect whether or not there is an abnormality in the detection target data Z. The noise removal model and correction process shown in FIG. 3 are similar to the noise removal model and correction process described in FIG. 2.

[0040] In the embodiment of Fig. 3, all points of the detection target data are used in the correction process, and the corrected data is made closer to the detection target data, thereby making full use of known information. Note that in the embodiment of Fig. 3, as described above, the corrected i-th data X' T-i The speed at which the corrected data approaches the target data Z can be limited by the magnitude of the weight α, which is selected so that the corrected data does not approach the target data too quickly, resulting in potential outliers. Here, i denotes the current iteration among T iterations.

[0041] In an embodiment of the present disclosure, the process of detecting the presence or absence of an abnormality may be performed in units of points. For example, the presence or absence of an abnormality is determined based on the difference between one point of the final corrected data X'0 and a corresponding point in the detection target data Z. The process of detecting the presence or absence of an abnormality may also be performed based on a line segment made up of multiple points. If the difference between any of the multiple points making up the line segment and the corresponding point in the detection target data Z exceeds a threshold, it is determined that the line segment has an abnormality.

[0042] In an embodiment of the present disclosure, after an anomaly detection method detects an anomaly in the target data, a machine learning model can further identify various types of anomalies, that is, perform root cause analysis based on expert knowledge to determine whether the anomaly is a key quality indicator (KQI) anomaly, a key performance indicator (KPI) anomaly, a hardware anomaly, a software anomaly, an interference anomaly, a blocking anomaly, or any other suitable type of anomaly.

[0043] FIG. 4 is a graph showing the performance of an interpolation-based anomaly detection method and an embodiment of the present disclosure. FIG. 4 shows two metrics: F1 score and recall. The F1 score is the harmonic mean of precision and recall, and indicates the balance between the precision and recall of the model. Recall focuses on whether the diffusion model can detect all anomalous data, while precision focuses on how many of the data detected as anomalous by the diffusion model are correct.

[0044] 4, the interpolation-based anomaly detection method exhibits dramatic fluctuations in the F1 score, with a large difference between the maximum and minimum values. In contrast, the anomaly detection method according to an embodiment of the present disclosure maintains the average F1 score close to the maximum value achieved by the interpolation-based method, with no significant fluctuations.

[0045] 4, the anomaly detection method based on interpolation exhibits dramatic fluctuations in recall, with a large difference between the maximum and minimum values. In contrast, the anomaly detection method according to an embodiment of the present disclosure maintains the recall near the maximum value achieved by the interpolation-based method, with no significant fluctuations.

[0046] According to the embodiment of the present disclosure, all known information (all points) of the detection target data is used at each step of the correction process, thereby avoiding the problem of poor stability caused by selecting a small number of observation points in the interpolation-based method, and effectively improving stability while ensuring performance.

[0047] In the embodiment of the present disclosure, the weight α limits the convergence speed, preventing the generation of anomalies due to too fast approach to the detection target data. In addition, in the embodiment of the present disclosure, the diffusion model is trained using normal data, so that anomalous parts of the detection target data are removed through multiple iterations.

[0048] Next, an anomaly detection device 600 according to an embodiment of the present disclosure will be described with reference to Fig. 5. Fig. 5 is a schematic diagram of an anomaly detection device according to an embodiment of the present disclosure. As described above, the function of the anomaly detection device of this embodiment is the same as the details of the method described with reference to Fig. 2, and therefore, for the sake of simplicity, detailed description of the same content will be omitted.

[0049] According to an embodiment of the present disclosure, the anomaly detection device includes a processor 502 and a memory 501 storing computer-readable instructions, and when the computer-readable instructions are executed by the processor, an anomaly detection method is executed, including the steps of: performing a noise removal process on noise data using a noise removal model to generate noise-removed data; performing a correction process on the noise-removed data based on the detection target data to make the corrected data closer to the detection target data than the noise-removed data; inputting the corrected data into the noise removal model, repeating the noise removal process and the correction process multiple times to obtain final corrected data; and detecting whether or not there is an anomaly in the detection target data based on the final corrected data and the detection target data.

[0050] Regarding the technical effects of the anomaly detection device 500 based on a noise removal model in different embodiments, reference can be made to the technical effects of the anomaly detection method based on a noise removal model provided in the embodiments of the present disclosure, and therefore such explanation will be omitted here.

[0051] The noise removal model-based anomaly detection device 500 may be applied to various suitable electronic devices.

[0052] FIG. 6 is a schematic diagram of a computer-readable storage medium 600 according to an embodiment of the present disclosure.

[0053] As shown in FIG. 6 , the present disclosure further includes a computer-readable storage medium 600 having computer-readable instructions 601 stored therein. When the computer-readable instructions are executed by a computer, the computer performs an anomaly detection method based on a noise removal model, including the steps of: performing a noise removal process on noise data using a noise removal model to generate noise-removed data; performing a correction process on the noise-removed data based on the detection target data to make the corrected data closer to the detection target data than the noise-removed data; inputting the corrected data into the noise removal model, repeating the noise removal process and the correction process multiple times to obtain final corrected data; and detecting whether or not there is an anomaly in the detection target data based on the final corrected data and the detection target data.

[0054] Each aspect / embodiment described herein may be used alone, in combination, or switched during execution. Furthermore, the order of processing steps, sequences, flowcharts, etc. described herein may be changed as long as there is no contradiction. For example, with respect to the methods described herein, various step units are provided in an exemplary order, but the present invention is not limited to the specific order provided.

[0055] As used herein, the phrase "based on" does not mean "based only on," unless otherwise specified in another paragraph. In other words, the phrase "based on" means both "based only on" and "based at least on."

[0056] As used herein, any reference to units using names such as "first," "second," etc., is not intended to be a complete limitation on the number or order of the units. These names may be used herein as a convenient way to distinguish between two or more units. Thus, a reference to a first unit and a second unit does not imply that only two units are possible, or that the first unit precedes the second unit in some way.

[0057] When the terms "include," "comprising," and variations thereof are used in this specification or claims, these terms are as open-ended as the term "having." Furthermore, the term "or" used in this specification or claims does not mean exclusive or (XOR).

[0058] Those skilled in the art will appreciate that various aspects of the present application can be described and exemplified in terms of several patentable categories or contexts, including any new and useful process, machine, manufacture, combination of matter, or any new and useful improvement thereof. Accordingly, various aspects of the present application may be implemented entirely in hardware, entirely in software (including firmware, resident software, microcode, etc.), or a combination of hardware and software. Such hardware or software may also be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." Alternatively, various aspects of the present application may be expressed as a computer product disposed on one or more computer-readable medium(s) containing computer-readable program code.

[0059] This application uses specific terms to describe embodiments of the application. For example, "one embodiment," "an embodiment," and / or "some embodiments" refer to a feature, structure, or characteristic associated with at least one embodiment of the application. Therefore, it should be emphasized that "an embodiment," "one embodiment," or "one alternative embodiment" mentioned more than once in different places in this specification do not necessarily refer to the same embodiment. Furthermore, certain features, structures, or characteristics in one or more embodiments of the application may be combined as appropriate.

[0060] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art of the present disclosure. It should also be understood that terms defined in general dictionaries should be interpreted in a manner consistent with the meaning in the context of the relevant technology, and should not be interpreted in an idealized or extremely formal sense unless explicitly defined herein.

[0061] Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the purpose and scope of the present disclosure as defined by the claims. Therefore, the description in this specification is for illustrative purposes only and does not limit the present disclosure.

Claims

1. performing a noise removal process on the noise data using the noise removal model to generate noise-removed data; performing a correction process on the noise-removed data based on the detection target data, so that the corrected data is closer to the detection target data than the noise-removed data; inputting the corrected data into the noise removal model, and repeating the noise removal process and the correction process multiple times to obtain final corrected data; and detecting whether or not there is an abnormality in the detection target data based on the final corrected data and the detection target data.

2. The anomaly detection method according to claim 1 , wherein the noise removal process is performed by selecting corresponding model parameters of the noise removal model based on the number of times the noise removal process has been repeated.

3. the noise distribution that the noise data follows is the same as the noise distribution that noise in the training data of the denoising model follows; 3. The anomaly detection method according to claim 1, wherein a size of the noise data is the same as a size of the detection target data.

4. The anomaly detection method according to claim 1 , wherein the correction process is based on all points in the detection target data.

5. 3. The anomaly detection method according to claim 1, wherein the correction process is based on a gradient correction method to make the corrected data closer to the detection target data than the noise-removed data.

6. The step of implementing the correction process based on the gradient correction method includes a step of obtaining a difference by subtracting the noise-removed data from the detection target data; The anomaly detection method according to claim 5 , further comprising the step of multiplying the difference by a weight and then adding the noise-removed data to obtain the corrected data.

7. The step of detecting whether or not there is an abnormality in the detection target data includes:

3. The anomaly detection method according to claim 1, further comprising a step of determining that an anomaly exists in the detection target data when a difference between a point in the final corrected data and a corresponding point in the detection target data is greater than a threshold value.

8. 3. The anomaly detection method according to claim 1, wherein the detection target data is time-series data of an index of a communication system.

9. An abnormality detection device, a noise removal unit that performs noise removal processing on the noise data using the noise removal model and generates noise-removed data; a correction unit that performs a correction process on the noise-removed data based on the detection target data, and makes the corrected data closer to the detection target data than the noise-removed data, the noise removal unit and the correction unit repeat the noise removal process and the correction process on the corrected data multiple times to obtain final corrected data; The anomaly detection device further includes a detection unit that detects whether or not there is an anomaly in the detection target data based on the final corrected data and the detection target data.

10. 1. A computer program product including computer commands, A computer program product, wherein the computer commands, when executed by a processor, perform the anomaly detection method of claim 1 .

Images